Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix exec and eval commands #239

Open
shhlife opened this issue Jan 26, 2025 · 1 comment
Open

Fix exec and eval commands #239

shhlife opened this issue Jan 26, 2025 · 1 comment
Assignees

Comments

@shhlife
Copy link
Collaborator

shhlife commented Jan 26, 2025

There are two nodes which will be caught by ComfyUI's upcoming security measures. They're both innocuous, but I need to resolve them. The gtUIBaseRagModule.py issue should be resolvable - but I'm not sure yet how to solve the gtUICodeExecutionTask.py one.

Security warnings found:
nodes/rag/gtUIBaseRagModule.py:34:24: S307 Use of possibly insecure function; 
consider using `ast.literal_eval`
   |
32 |             # Try to evaluate the string as a dictionary
33 |             try:
34 |                 return eval(f"dict({params})")
   |                        ^^^^^^^^^^^^^^^^^^^^^^^ S307
35 |             except Exception:
36 |                 # If evaluation fails, try to parse it as JSON
   |

nodes/tasks/gtUICodeExecutionTask.py:233:5: S102 Use of `exec` detected
    |
[231](https://github.com/griptape-ai/ComfyUI-Griptape/actions/runs/12971183494/job/36177302149#step:3:245) | """
232 |     # Compile and execute the code
[233](https://github.com/griptape-ai/ComfyUI-Griptape/actions/runs/12971183494/job/36177302149#step:3:247) |     exec(wrapped_code, exec_globals, exec_locals)
    |     ^^^^ S102
[234](https://github.com/griptape-ai/ComfyUI-Griptape/actions/runs/12971183494/job/36177302149#step:3:248) |
235 |     # Extract the dynamically created function
    |


We will soon disable exec and eval, and multiple statements in a single line, so
this will be an error soon.
@shhlife shhlife added the bug Something isn't working label Jan 26, 2025
@shhlife shhlife self-assigned this Jan 26, 2025
@shhlife
Copy link
Collaborator Author

shhlife commented Jan 27, 2025

I fixed the gtUIBaseRagModule error - so that's handled.

But not sure how to handle gtUICodeExecutionTask.

I might just make a bunch of options for string manipulation instead and see if that handles most situations

@shhlife shhlife removed the bug Something isn't working label Feb 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant